FundReap
Product Pricing Guides Sign in Get started free

You're handing over your receivables. Here's exactly what happens to them.

This page is deliberately specific. "Bank-grade security" means nothing; what you actually want to know is which numbers leave your office, where they sit, and how fast you can get rid of them.

The short version
Read only There is no connection to Tally. We read a file you export yourself, so writing back to your books is not something we could do if we wanted to.
No install No connector, add-on or ODBC required by default — you export and upload it yourself. Two optional connectors exist to automate your own export; both still just read a file, same as the manual path.
The file isn't kept We read the spreadsheet, take the numbers, and discard it. The upload itself is not stored.
Delete means delete One button in Settings, gone immediately — not queued, not "within 30 days".
What we read, and what we never see

What we read

  • Customer (party) names
  • Invoice numbers and dates
  • Amounts outstanding, and due dates
  • Which bills were settled, and when
  • Phone numbers — only ones you type in yourself

What never reaches us

  • Your sales, purchases, profit or margins
  • Expenses, salaries or payroll
  • Bank accounts or balances
  • GST returns and filings
  • Stock, inventory or item-level data
  • Anything about your suppliers

The Outstandings → Receivables report contains only what's above. We couldn't see the rest even if the file were bigger — we look at the columns we understand and refuse the rows we don't.

Practical details

Getting in

There is no password to steal. Signing in sends a single-use link to your email that expires in twenty minutes, and your session lasts 90 days so you aren't going through the inbox every month. Lost your phone? Sign out everywhere in Settings kills every session immediately.

Sign-in requests are rate limited per email and per IP, so nobody can use the login form to flood a stranger's inbox with links.

In transit and at rest

Everything travels over HTTPS. Cookies are HttpOnly and SameSite=Lax, so they can't be read by scripts or sent along by another site. Your data sits in its own workspace, scoped to your organisation on every single query — not filtered in the browser.

Your team

On the Business plan you can invite colleagues. They see the same plan and can chase customers; only the owner manages the team. Removing someone destroys their sessions on the spot rather than letting them run out.

Payments

Card and UPI details never touch us — checkout runs through Razorpay, and we only ever see whether your subscription is active. Cancel from your own UPI app; there is no retention call, because there is nobody to call.

Deleting everything

Settings → Delete everything. Uploads, customer names, phone numbers, chase history, the lot. It happens when you press it. You don't have to email anyone and there's no offer to win you back.

Being straight with you

We're a small independent product, not a bank. We aren't going to claim certifications we don't hold — if you need SOC 2 or ISO 27001 paperwork for a procurement process, we don't have it today, and you should know that before you sign up rather than after.

What we can offer instead is a product designed so that the blast radius is small: no write access to your accounts, a narrow slice of data, no file retention, and a delete button that works. If something here isn't clear enough, ask us — we'd rather answer it than have you guess.

Run a free health check

No account needed for the free numbers · Read the privacy policy